PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 9 — 15 Questions

Question 1

A company is migrating CI/CD pipelines to Google Cloud. They want to deploy containerized applications to GKE using GitOps principles with Config Sync. Which two components are required? (Choose 2)

Accepted Answer

Config Sync operator (reconciler) installed on the GKE cluster. Config Sync requires a Git repository as the source of truth (source of truth) and the Config Sync operator installed on the cluster to sync. Cloud Build is not required for Config Sync itself.

Answer

Artifact Registry

Answer

Cloud Build trigger

Answer

Binary Authorization

Question 2

A team is designing a CI/CD pipeline for a microservice that requires canary deployments with metrics-based rollback. They want to use Cloud Deploy and Cloud Run. Which three features must they configure? (Choose 3)

Accepted Answer

Canary deployment strategy with canary percentage and metric thresholds. Cloud Deploy's canary strategy requires a delivery pipeline with stages, targets using Cloud Run, and a canary deployment strategy with percentage and metrics. Approval gates are optional.

Answer

Binary Authorization policy

Answer

Manual approval gate on the prod target

Question 3

A developer is using Cloud Build to build a Docker image and wants to use build substitutions to dynamically set the image tag. Which built-in substitutions can they use? (Choose 2)

Accepted Answer

$SHORT_SHA. Cloud Build provides built-in substitutions like $SHORT_SHA (short commit SHA) and $BRANCH_NAME. $TAG_NAME is not a built-in substitution; $_USER_DEFINED is a custom substitution with underscore prefix.

Answer

$TAG_NAME

Answer

$_IMAGE_NAME

Answer

$_CUSTOM_TAG

Question 4

A DevOps engineer wants to trigger a Cloud Build pipeline automatically every time a pull request is created against the main branch of a Cloud Source Repositories repository. Which type of build trigger should they configure?

Accepted Answer

Pull request trigger. Cloud Build supports pull request triggers that fire on PR creation or update. Manual triggers require human action, push triggers fire on branch commits, and scheduled triggers run on a cron schedule.

Answer

Push trigger

Answer

Manual trigger

Answer

Scheduled trigger

Question 5

An engineer needs to build a Docker image using Cloud Build and ensure the image is cached across builds to speed up subsequent runs. The build uses Kaniko. What should the engineer add to the cloudbuild.yaml to enable layer caching?

Accepted Answer

Use the 'kaniko' builder and set '--cache=true' and '--cache-repo'. Cloud Build with Kaniko supports caching by specifying a destination for cached layers. The --cache=true flag enables caching, and --cache-repo sets the repository where cached layers are stored. --destination is used for the final image but not for cache configuration alone.

Answer

Configure a build pool with a persistent disk for caching

Answer

Add step using 'docker build' with '--cache-from'

Answer

Set the 'images' field in cloudbuild.yaml to enable automatic caching

Question 6

A company uses Cloud Deploy to manage deployments to multiple GKE clusters across environments. They want to implement a canary deployment strategy where 10% of traffic goes to the new version initially, and after manual approval, the remaining 90% rolls out. What should be included in the delivery pipeline configuration?

Accepted Answer

Define a 'canary' strategy with a first phase of 10% and a second phase of 90% with an approval gate. Option B is correct because Cloud Deploy's 'canary' strategy allows defining multiple phases with incremental traffic percentages, and an approval gate can be inserted between phases to require manual sign-off before proceeding. This directly matches the requirement: a first phase sending 10% traffic to the new version, then a manual approval, followed by a second phase rolling out the remaining 90%.

Answer

Configure a 'canary' strategy with a single phase of 10% and rely on external traffic management

Answer

Set the rollout strategy to 'standard' and use skaffold.yaml for traffic splitting

Answer

Use a 'blueGreen' strategy with a 10% preview phase

Question 7

An organization wants to deploy a Cloud Run service using Cloud Deploy. They need to run a database migration script before each new revision starts serving traffic. Which Cloud Deploy feature should they use?

Accepted Answer

Configure a preDeploy hook that runs a Cloud Run Job. Cloud Deploy supports deployment hooks that execute Cloud Run Jobs before (preDeploy) or after (postDeploy) a rollout. PreDeploy hooks run before the new revision starts serving traffic, making them ideal for database migrations.

Answer

Use a Cloud Build step in the delivery pipeline

Answer

Add a manual approval gate before deployment

Answer

Use a postDeploy hook to run the migration after traffic is switched

Question 8

A team uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that if a cluster's state drifts from the desired state in the Git repository, it is automatically corrected. Config Sync is installed with the default settings. What else must be configured?

Accepted Answer

No additional configuration is required; drift correction is automatic. Config Sync, by default, operates in a continuous reconciliation loop. It periodically compares the live state of the cluster against the desired state defined in the Git repository. If any drift is detected, Config Sync automatically applies the necessary changes to revert the cluster back to the desired state. Therefore, no additional configuration is needed for automatic drift correction.

Answer

Enable the 'drift correction' option in Config Sync

Answer

Set up a Cloud Scheduler to run 'kubectl apply' periodically

Answer

Install Anthos Config Management with the 'policy controller' enabled

Question 9

A developer needs to deploy a containerized application to Cloud Run using the gcloud command. Which two flags are required to successfully deploy?

Accepted Answer

--region. The gcloud run deploy command requires --image to specify the container image and --region to specify the region. Other flags like --ingress and --max-instances are optional.

Answer

--max-instances

Answer

--concurrency

Answer

--ingress

Question 10

An organization uses Cloud Build to build and deploy applications. They need to ensure that build secrets (e.g., API tokens) are securely injected into build steps without being exposed in the build logs. Which two actions should they take?

Accepted Answer

Use the 'secretEnv' field in the build step to reference a secret from Secret Manager. Option B is correct because the `secretEnv` field in a Cloud Build step allows you to inject a secret from Secret Manager into the build environment as an environment variable, without the secret value being written to build logs. This ensures the secret is available to the step at runtime but never exposed in log output.

Answer

Use the 'env' field to pass the secret as a build substitution variable

Answer

Encrypt the entire cloudbuild.yaml using Cloud KMS

Answer

Store the secret value directly in the cloudbuild.yaml file

Question 11

A company wants to implement Binary Authorization for containers deployed to GKE. They need to ensure that only images signed by their internal CI system are allowed to run. Which three components are required?

Accepted Answer

An attestor in Binary Authorization. Binary Authorization requires images to be signed (e.g., using Cloud Key Management Service or Signify), an attestor that verifies signatures, and an admission controller (Binary Authorization) that enforces the policy on the cluster.

Answer

Cloud Build with privilege escalation mode

Answer

Container Registry with vulnerability scanning enabled

Question 12

A DevOps team wants to use Cloud Deploy to promote releases across multiple targets. They need to define a delivery pipeline that includes a canary deployment for a GKE cluster and a standard deployment for Cloud Run. Which two strategies can they use in the same pipeline?

Accepted Answer

Canary strategy for GKE. Cloud Deploy allows different deployment strategies per target. You can mix 'canary' for GKE and 'standard' for Cloud Run in the same delivery pipeline. 'Blue/green' is also supported but not required.

Answer

Progressive delivery strategy with manual approval

Answer

Blue/green strategy for Cloud Run

Answer

Rolling update strategy for GKE

Question 13

An engineer is configuring a Cloud Build build pool to connect to resources in a VPC network. They need to ensure the build can access a private Artifact Registry repository. Which three steps should they take?

Accepted Answer

Set up Private Service Connect for Artifact Registry. Private pools allow builds to use a VPC network. To access private Artifact Registry, the pool must be in the same VPC as the registry endpoint (which uses Private Service Connect or VPC peering), and the service account must have permission to read from the registry.

Answer

Enable public access on the Artifact Registry repository

Answer

Configure a Cloud NAT gateway for the VPC

Question 14

A team uses Helm charts to deploy applications to GKE. They want to use Kustomize to manage environment-specific overlays for different clusters. Which two tools or approaches can they combine to achieve this?

Accepted Answer

Use Skaffold to run Helm and Kustomize in sequence. Option A is correct because Skaffold can orchestrate both Helm and Kustomize in a single pipeline, allowing you to first render Helm charts and then apply Kustomize overlays for environment-specific customizations. Option D is correct because Kustomize's 'helmCharts' plugin can directly render Helm charts and apply overlays in one step, providing an alternative approach. Both methods enable combining Helm's templating with Kustomize's overlays.

Answer

Use Config Sync to apply Kustomize overlays directly

Answer

Use 'kubectl apply -k' to apply Helm charts without overlays

Answer

Use Cloud Build's built-in Helm support only

Question 15

An organization wants to use Cloud Build to automatically build and test code changes when a developer pushes to any branch in a Cloud Source Repositories repository. Which two configurations are needed?

Accepted Answer

A cloudbuild.yaml file in the repository. A push trigger monitors branch pushes. To capture all branches, the trigger should use a regex pattern like '.*'. Additionally, the cloudbuild.yaml file must be present in the repository to define the build steps.

Answer

A pull request trigger

Answer

A scheduled trigger with cron

Answer

A manual trigger with webhook